[LLVMbugs] [Bug 19621] New: bad cast<> in slp vectorizer

[bugzilla-daemon at llvm.org]

http://llvm.org/bugs/show_bug.cgi?id=19621

            Bug ID: 19621
           Summary: bad cast<> in slp vectorizer
           Product: libraries
           Version: trunk
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: Loop Optimizer
          Assignee: unassignedbugs at nondot.org
          Reporter: nlewycky at google.com
                CC: llvmbugs at cs.uiuc.edu
    Classification: Unclassified

Created attachment 12462
  --> http://llvm.org/bugs/attachment.cgi?id=12462&action=edit
testcase .ll

Testcase is 52 lines of IR, attached.

$ opt -slp-vectorizer b.ll

opt: /usr/local/google/home/nlewycky/llvm/include/llvm/Support/Casting.h:237:
typename llvm::cast_retty<X, Y*>::ret_type llvm::cast(Y*) [with X =
llvm::Instruction; Y = llvm::Value; typename llvm::cast_retty<X, Y*>::ret_type
= llvm::Instruction*]: Assertion `isa<X>(Val) && "cast<Ty>() argument of
incompatible type!"' failed.

Program received signal SIGABRT, Aborted.
0x00007ffff6ced425 in __GI_raise (sig=<optimized out>) at
../nptl/sysdeps/unix/sysv/linux/raise.c:64
64      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007ffff6ced425 in __GI_raise (sig=<optimized out>) at
../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007ffff6cf0b8b in __GI_abort () at abort.c:91
#2  0x00007ffff6ce60ee in __assert_fail_base (fmt=<optimized out>,
assertion=0x1d07660 "isa<X>(Val) && \"cast<Ty>() argument of incompatible
type!\"", 
    file=0x1d07618
"/usr/local/google/home/nlewycky/llvm/include/llvm/Support/Casting.h",
line=<optimized out>, function=<optimized out>) at assert.c:94
#3  0x00007ffff6ce6192 in __GI___assert_fail (assertion=0x1d07660 "isa<X>(Val)
&& \"cast<Ty>() argument of incompatible type!\"", file=0x1d07618
"/usr/local/google/home/nlewycky/llvm/include/llvm/Support/Casting.h", 
    line=237, 
    function=0x1d07f80 <llvm::cast_retty<llvm::Instruction,
llvm::Value*>::ret_type llvm::cast<llvm::Instruction,
llvm::Value>(llvm::Value*)::__PRETTY_FUNCTION__> "typename llvm::cast_retty<X,
Y*>::ret_type llvm::cast(Y*) [with X = llvm::Instruction; Y = llvm::Value;
typename llvm::cast_retty<X, Y*>::ret_type = llvm::Instruction*]") at
assert.c:103
#4  0x0000000000ab7092 in llvm::cast<llvm::Instruction, llvm::Value>
(Val=0x2ed5480) at
/usr/local/google/home/nlewycky/llvm/include/llvm/Support/Casting.h:237
#5  0x0000000001632d71 in (anonymous
namespace)::SLPVectorizer::tryToVectorizeList (this=0x2ebebb0, VL=..., R=...,
BuildVector=...) at SLPVectorizer.cpp:2204
#6  0x0000000001634ea5 in (anonymous
namespace)::SLPVectorizer::vectorizeChainsInBlock (this=0x2ebebb0,
BB=0x2eb4fb0, R=...) at SLPVectorizer.cpp:2762
#7  0x0000000001631c53 in (anonymous namespace)::SLPVectorizer::runOnFunction
(this=0x2ebebb0, F=...) at SLPVectorizer.cpp:1926
#8  0x0000000001c49958 in llvm::FPPassManager::runOnFunction (this=0x2ec8ed0,
F=...) at LegacyPassManager.cpp:1540
#9  0x0000000001c49ac8 in llvm::FPPassManager::runOnModule (this=0x2ec8ed0,
M=...) at LegacyPassManager.cpp:1560
#10 0x0000000001c49e1c in (anonymous namespace)::MPPassManager::runOnModule
(this=0x2eb3d30, M=...) at LegacyPassManager.cpp:1618
#11 0x0000000001c4a4c6 in llvm::legacy::PassManagerImpl::run (this=0x2eb3a40,
M=...) at LegacyPassManager.cpp:1725
#12 0x0000000001c4a6d1 in llvm::legacy::PassManager::run (this=0x7fffffffe1d0,
M=...) at LegacyPassManager.cpp:1760
#13 0x0000000000adc658 in main (argc=3, argv=0x7fffffffe488) at opt.cpp:631
(gdb) frame 5
#5  0x0000000001632d71 in (anonymous
namespace)::SLPVectorizer::tryToVectorizeList (this=0x2ebebb0, VL=..., R=...,
BuildVector=...) at SLPVectorizer.cpp:2204
2204            Instruction *InsertAfter = cast<Instruction>(VectorizedRoot);
(gdb) p VectorizedRoot
$1 = (llvm::Value *) 0x2ed5480
(gdb) call VectorizedRoot->dump()
<2 x float> undef
(gdb) p VL.size()
$3 = 2

Attempting to call VL[0]->dump() or VL[1]->dump() shows corrupt memory,
consistent with use-after-free.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20140501/95e0262c/attachment.html>